A lot of people have been asking for a new release of Smatch because the
v1.73 release was from 2022 and it complicates creating distro packages.
There have been quite a few of improvements, but the main thing recently
is that I've been turning off warnings by default so that the zero day
bot can send emails without my filtering them.
I haven't been sending Spectre v1 warnings for some time. These are
places where we should add array_index_nospec(). It still an issue but
I've never felt like I've understood the issue well enough to triage
these. If anyone would like to help triage these warnigns I could
probably improve the warning a lot. (Does anyone have contacts at
Intel or AMD?)
The other warning that I disabled was about uninitialized variables. This
check is pretty good, but it requires cross function analysis and the zero
day bot doesn't do that. For example, we often have loops:
for (i = 0; i < parameter_limit; i++) {
Without cross function analysis we have to consider that parameter_limit
could be zero or even negative. The other things about uninitialized
variables is that Clang does a pretty good job warning about these.
The zero day bot has a false positive with regards to "iterator not
incremented" warnings, but I've never been able to reproduce that despite
trying really hard so I disabled that as well.
I think most people use Smatch from git but if you're using a package
then there are lots of improvements in here.
$ git log --oneline 1.73..1.74 | wc -l
874
All good things. :)
regards,
dan carpenter
